Get FREE shipping on all Australian orders over $50 AUD. Shop Now →
Teafy Pty Ltd
Version 2.0, effective 1st January 2026
Teafy Pty Ltd (ABN 63 658 494 010, ACN 658 494 010), referred to in this Policy as "Teafy", "we", "us" or "our".
Registered office: 470 St Kilda Road, Melbourne VIC 3004, Australia.
This Policy explains how we collect, hold, use, disclose and protect personal information, and how you can access it, correct it, or make a complaint. This Policy is not a contract and does not create rights beyond those conferred by law.
2.1 We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs 1 to 13), to the extent they apply to us.
2.2 Businesses with an annual turnover of $3 million or less are generally exempt from the Privacy Act. Whether or not that exemption applies to Teafy from time to time, we apply the standards described in this Policy as a matter of practice.
2.3 We review this Policy periodically and whenever our practices change. The current version is always published at teafy.com.au/privacy-policy and supersedes all earlier versions.
Identity: your name, and your date of birth if you choose to enter it for a Rewards birthday bonus.
Contact details: email address, phone number, delivery address and billing address.
Account information: your username and password. Passwords are stored in hashed form and we never see them.
Order information: the products you order, your order history, the Delivery Option you selected, your delivery instructions, any nominated safe place or collection point, and any gift messages.
Payment information: card type, the last four digits of your card, expiry date and billing name. We do not collect or store full card numbers or CVV codes. See clause 3.4.
Subscription information: your chosen frequency, next billing date, your minimum term progress, and your pause and cancellation history.
Rewards information: your Points balance, earning and redemption history, referral links and referred accounts.
Communications: emails, phone calls, contact form messages, chat messages, and any reviews or photographs you submit to us.
Wholesale enquiries: business name, ABN, trading address and trade references.
Affiliate and partnership applications: your name, contact details, social media handles, audience information, payment details for commission, and tax details where we are required to collect them.
Gift recipients: if you send an Order to another person, their name, delivery address and phone number. You must have their permission to give us these details.
Proof of delivery: where your parcel is delivered, the delivery record the Carrier creates and provides to us. Depending on the Delivery Option and the Carrier, this may include a signature, the first name or surname of the person who accepted the parcel, a Safe Drop photograph of the parcel at the delivery location, a GPS coordinate, and the date and time of the delivery or collection event.
Your IP address and the approximate location derived from it, device type, operating system, and browser type and version.
Pages viewed, time spent on each page, the URL that referred you, and searches you run on our site.
Cookie and pixel identifiers.
Device and browser characteristics that allow us to distinguish one device from another.
Payment processors: transaction outcomes, fraud signals and chargeback notices.
Carriers: tracking events, delivery scans, signatures, the name of the person who accepted a parcel, Safe Drop photographs, GPS records, collection and carding notices, and delivery exceptions.
Advertising and analytics platforms: aggregated campaign and audience data.
Review platforms: review content and verification status.
Social media platforms: where you interact with our accounts or use a social login.
We do not collect or store full payment card numbers, CVV codes or bank credentials. Card details are entered directly into our payment processor's systems and are tokenised. Teafy never has access to them.
We do not ask for sensitive information as defined in the Privacy Act, including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record or biometric data. If you choose to tell us about an allergy, intolerance or health condition, for example when asking whether a product is suitable for you, you consent to us using that information only to answer your enquiry and handle any related claim. We do not use it for marketing. If you send us other sensitive information we did not ask for, we may destroy it or remove anything that identifies you.
4.1 Directly from you, when you create an account, place an order, sign up to our newsletter, join the Rewards Program, complete a contact form, email or phone us, submit a review, enter a competition, apply to our affiliate program, or make a wholesale enquiry.
4.2 Automatically, through cookies, pixels and analytics on our website. See clause 9.
4.3 From third parties, as described in clause 3.3. Where we collect your personal information from someone other than you, we take reasonable steps to notify you where APP 5 requires it.
To fulfil your order: processing payment, picking and packing, printing labels, arranging delivery and sending you tracking information.
To administer Delivery Options: lodging your parcel on the service you selected and paid for, instructing the Carrier whether a signature is required, and handling a refund of a Delivery Option charge where one is payable.
To prove delivery: recording how, when and to whom a parcel was delivered or made available for collection, so that we can answer a delivery enquiry, investigate a claim that a parcel was not received, lodge and support a claim with a Carrier, and respond to a payment dispute or chargeback.
To manage your account: authentication, order history, saved addresses and the Customer Portal.
To manage subscriptions: recurring billing, renewal reminders, pausing and cancellation, tracking the minimum term, and calculating and notifying any discount recovery amount.
To run the Rewards Program: crediting and reversing Points, issuing reward codes and verifying referrals.
To administer affiliate and partnership arrangements: tracking referred sales, calculating and paying commission, and verifying compliance with our published terms.
To maintain batch traceability and manage a product withdrawal or recall: identifying which batch each order received, and contacting affected customers.
To detect and prevent misuse and fraud, as described separately in clause 6.
To provide customer service: answering enquiries, investigating carrier claims and defect claims, and handling complaints.
For marketing: email and SMS marketing where permitted, and building advertising audiences. See clause 8.
To improve our website: analytics, testing, and understanding which pages and products perform.
For legal and compliance purposes: tax and financial records, Australian Consumer Law and food safety obligations, responding to lawful requests, establishing and defending legal claims, and enforcing our Terms and Conditions.
5.1 We may also use your personal information for a secondary purpose related to a purpose above, where you would reasonably expect us to, or where the Privacy Act otherwise permits.
6.1 To protect the integrity of our pricing, promotions and Rewards Program, and to enforce our Terms and Conditions, we collect and analyse:
(a) account details, including email addresses and variants of them;
(b) delivery and billing addresses;
(c) tokenised payment instrument identifiers, which allow us to identify that two orders used the same card without us seeing the card number;
(d) device and browser identifiers;
(e) IP addresses;
(f) patterns in order, discount code, referral and Points activity;
(g) the Delivery Option selected on each Order, and the delivery outcome recorded by the Carrier; and
(h) patterns in non receipt, non collection, damage and refund claims across Orders, accounts, addresses and payment instruments.
6.2 We use this information to identify where two or more accounts are likely to be controlled by the same person, and to detect duplicate welcome discount claims, self referrals, shared or leaked reward codes, and subscription cycling. By creating an account or placing an order, you consent to this collection and analysis.
6.3 Where this analysis leads us to propose action against your account, a person at Teafy makes the decision. We do not close accounts or charge amounts solely on the basis of an automated process. We will notify you and provide an opportunity to respond before acting, except where we reasonably suspect fraud, unauthorised use of a payment instrument, or a risk to the safety of any person.
6.4 We retain the evidence supporting any such decision for at least 12 months and may provide a summary of it on request.
(a) Where you make a claim that a parcel was not received, was not delivered as instructed, or arrived damaged, we collect and use the proof of delivery records described in clause 3.1, together with the Carrier's investigation records, to assess the claim.
(b) We may provide those records, and the order, account and communication records relating to the claim, to the Carrier for the purposes of its investigation and any claim we make against it, and to our payment processor and the relevant card scheme where a payment dispute or chargeback is raised.
(c) Where theft is alleged and you provide a police report or event number, we collect and retain it for the purposes of the claim and any Carrier claim.
(d) We retain these records for the period stated in clause 11.
7.1 We do not sell your personal information.
7.2 We disclose personal information to the following categories of recipient, and only as reasonably necessary:
Ecommerce platform and hosting, to run our website and store: Webflow (United States).
Payment processing, to take payment, manage recurring billing, run fraud checks and respond to payment disputes: Stripe and PayPal, and card schemes and card issuers where a chargeback or payment dispute is raised.
Subscriptions and rewards, to manage recurring orders, Points and referrals: Monto.
Email and SMS, to send marketing campaigns, automated flows and transactional messages: Klaviyo (United States).
Shipping software, to print labels and send tracking notifications: ShipStation (United States).
Carriers, to deliver your order, to lodge it on the Delivery Option you selected, to capture a signature where Signature on Delivery applies, and to send you delivery and collection notices. The information we disclose includes your name, delivery address, phone number and email address, and where applicable the instruction that a signature is required. The Carrier provides us with the resulting delivery record, which may include a signature, the name of the person who accepted the parcel, a Safe Drop photograph and a GPS record. Carriers we use include Australia Post, and other carriers we use from time to time.
Customs, duties and international clearance, to calculate duties and taxes, prepare customs documentation and clear orders for delivery outside Australia: Zonos. Zonos operates internationally and may process your information in the United States and in other countries in which it operates, including in Europe.
Customs, border and postal authorities in the destination country, where required to clear your parcel. The information disclosed includes your name, delivery address, contact details, and a description and value of the Goods.
Analytics, to understand website performance and behaviour: Google Analytics, Google Search Console and Microsoft Clarity.
Advertising, to deliver and measure campaigns: Google Ads, Google Merchant Center and Meta.
Reviews, to collect, verify and display customer reviews: REVIEWS.io (United Kingdom).
Accounting and tax, to maintain our books, lodge BAS and keep statutory records.
Professional advisers: our lawyers, accountants, auditors and insurers.
Purchasers: where we sell or transfer all or part of our business or assets, to the purchaser and its advisers.
Government and regulators, where required or authorised by law, including the ATO, courts, police, the Office of the Australian Information Commissioner, the ACCC, Food Standards Australia New Zealand and state and territory food authorities.
7.3 The providers named above may change from time to time. We may substitute a provider of the same category without amending this Policy.
7.4 We disclose personal information where required or authorised by law, including to comply with a subpoena or court order, or a request from a regulator or law enforcement agency acting within its powers, and where reasonably necessary to establish, exercise or defend a legal claim.
8.1 We send marketing emails and SMS where you have consented, or where you are an existing customer and the message relates to products of the kind you have bought from us, as permitted by the Spam Act 2003 (Cth).
8.2 Every marketing email contains a working unsubscribe link, and every marketing SMS contains an opt out instruction. We action opt out requests within 5 working days. The unsubscribe facility in any message remains functional for at least 30 days after that message is sent.
8.3 Opting out of marketing does not stop transactional messages, including order confirmations, shipping notifications, subscription renewal reminders, discount recovery notices, Points expiry notices, product recall notices and service messages. These are not marketing, and you cannot opt out of them while you hold an account or have an active order.
8.4 We may build advertising audiences by supplying hashed email addresses to advertising platforms, so that ads can be shown to, or withheld from, existing customers. You can opt out of this by emailing privacy@teafy.com.au.
8.5 You can update your marketing preferences at any time in the Customer Portal, or by emailing us.
9.1 We use cookies and similar technologies for four purposes:
Essential: your cart, login session, checkout and site security. These cannot be disabled without breaking the site.
Analytics: understanding how the site is used.
Advertising: measuring campaigns and showing relevant ads.
Functional: remembering your preferences.
9.2 You can block or delete cookies in your browser settings. Blocking essential cookies will prevent checkout from working, and we are not responsible for any loss of functionality that results.
9.3 You can opt out of certain tracking directly. For Google Ads, visit adssettings.google.com. For Google Analytics, visit tools.google.com/dlpage/gaoptout. For Meta, use the ad preferences in your Facebook or Instagram account.
9.4 We honour Global Privacy Control signals where the platforms we use support them.
10.1 We take reasonable steps to protect personal information using TLS and SSL encryption in transit, encryption at rest with our platform providers, access controls and role based permissions, hashed password storage, tokenised payment data, and multi factor authentication on administrative accounts.
10.2 No system, and no method of transmission over the internet, is completely secure. We cannot guarantee absolute security, and we do not warrant that our systems or those of our providers will be free from unauthorised access.
10.3 You are responsible for protecting your own account, including by using a unique password, never sharing your credentials, and signing out on shared devices. We are not responsible for loss arising from your failure to do so.
10.4 If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Order and transaction records: 7 years from completion of the transaction. The Corporations Act 2001 (Cth) requires a company to keep financial records for 7 years. The ATO's separate general requirement is 5 years, so the longer period governs.
Delivery Option selections and delivery outcome records: 7 years, as part of the order and transaction record.
Proof of delivery records, including signatures, the name of the person who accepted a parcel, Safe Drop photographs and GPS records: at least 24 months from the delivery date, and up to 7 years where they form part of our financial records or relate to an unresolved claim or dispute.
Account and profile data: while your account is active, then up to 24 months.
Rewards Points and history: while your account is active, then up to 24 months, for program administration and dispute resolution.
Subscription records, including minimum term progress and any discount recovery amount charged: 7 years, as part of the order and transaction record.
Batch traceability records: 7 years, so that a product withdrawal or recall can be administered and the customers who received an affected batch can be contacted.
Affiliate and partnership records, including commission calculations: 7 years, as part of our financial records.
Marketing consent records: for as long as consent stands, plus 2 years, as proof of consent under the Spam Act.
Fraud and misuse evidence: at least 12 months from the date of the decision, and longer where reasonably necessary to protect our legal position.
Carrier claim, chargeback and defect evidence: at least 24 months, and up to 7 years where it forms part of our financial records.
Website analytics: up to 26 months.
Contact form and email correspondence: up to 24 months.
11.1 We may retain personal information for longer where reasonably necessary to comply with a legal obligation, to resolve a dispute, or to establish, exercise or defend a legal claim.
11.2 When personal information is no longer needed for any purpose for which it may lawfully be used, and we are not required by law to retain it, we destroy it or de identify it. We may retain and use de identified and aggregated data indefinitely.
12.1 Access. You may request access to the personal information we hold about you. There is no charge to make a request. We may charge a reasonable cost based fee for giving access where a request is extensive. We will tell you the amount before proceeding.
12.2 Correction. You may ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We will correct it, or explain in writing why we have not.
12.3 Deletion. You may ask us to delete your personal information. We will do so unless we are required or entitled to retain it, including under clauses 11 and 11.1. We will tell you what has been retained and why.
12.4 Marketing opt out. See clause 8.
12.5 Anonymity. You may deal with us anonymously or under a pseudonym for general enquiries. We cannot fulfil an order without a name and a delivery address.
12.6 We may refuse a request for access or correction where the Privacy Act or another law permits or requires us to do so. Where we refuse, we will give you written reasons and tell you how to complain.
12.7 How to exercise these rights. Email privacy@teafy.com.au. We will verify your identity before acting on a request, acknowledge your request within 5 business days, and respond within 30 days.
13.1 Some of our service providers store or process personal information outside Australia. The countries in which recipients are likely to be located are:
United States: Webflow, Klaviyo, Stripe, PayPal, Google, Meta, Microsoft, ShipStation and Monto.
Germany: Monto.
United Kingdom: REVIEWS.io.
Where you place an order for delivery outside Australia, your personal information is also disclosed to Zonos, which operates internationally and may process your information in the United States and in other countries in which it operates, including in Europe, and to the customs, border and postal authorities of the country you have asked us to deliver to. Because our customers order from many countries, it is not practicable to list every such country in this Policy in advance. The country in each case is the destination country of your order.
13.2 Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual terms and by selecting providers with recognised security certifications.
13.3 When you create an account or place an Order, we ask you to consent to the disclosure of your personal information to overseas recipients of the kinds and in the countries described in this clause. If you give that consent, APP 8.1 will not apply, and we will not be accountable under the Privacy Act if an overseas recipient handles your information in a way that breaches the Australian Privacy Principles. You may withdraw your consent by emailing privacy@teafy.com.au, but we may then be unable to fulfil Orders or maintain your account.
13.4 Clause 13.3 does not limit any obligation we have under the Privacy Act that cannot lawfully be excluded.
14.1 Our website may contain links to third party websites, plug ins and applications. We do not control those third parties and we are not responsible for their privacy practices or content.
14.2 We encourage you to read the privacy policy of every website you visit.
15.1 Our website is not directed at children under 18, and we do not knowingly collect personal information from a person under 18.
15.2 If we become aware that we have collected personal information from a child under 18 without parental consent, we will delete it.
16.1 If you believe we have breached the Australian Privacy Principles, please contact our Privacy Officer:
Privacy Officer, Teafy Pty Ltd
470 St Kilda Road, Melbourne VIC 3004, Australia
privacy@teafy.com.au
16.2 We will acknowledge your complaint within 5 business days and respond within 30 days.
16.3 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
Online: oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001
17.1 We may update this Policy at any time. The effective date at the top shows when it last changed.
17.2 Where a change materially affects how we handle your personal information, we will notify you by email at least 14 days before it takes effect.
17.3 Your continued use of our website or services after a change takes effect constitutes acceptance of the updated Policy.
17.4 Previous versions are available on request.
18.1 This Policy is governed by the laws of Victoria, Australia.
Teafy Pty Ltd, ABN 63 658 494 010, ACN 658 494 010
470 St Kilda Road, Melbourne VIC 3004, Australia
privacy@teafy.com.au, 1300 986 888
Version 2.0, effective 1st January 2026
