ARCAVELLE / Privacy policy
Privacy policy
What personal information we collect, why, who receives it, where it goes and your rights.
Who is responsible for your information
Show Pony Group Pty Ltd (ACN 156 041 913), trading as ARCAVELLE, New South Wales 2017, Australia, is responsible for the personal information described here. Contact: support@arcavelle.shop, +61 493 643 903.
We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). Where we sell to people in the European Economic Area, Switzerland or the United Kingdom, we also act as controller under the EU General Data Protection Regulation, the Swiss Federal Act on Data Protection and the UK GDPR.
Collection notice
When you place an order, create an account, contact us or send a withdrawal, we collect the information you enter (name, email, phone, delivery and billing address, order details and your message). We collect it to process, deliver and support your order and to answer you. If you do not provide the required fields, we cannot fulfil your order. We disclose it to our payment provider, to the carriers and customs authorities that deliver your parcel, and to our hosting and email providers; some of them are outside Australia (see below). You can ask to access or correct your information, or complain about how we handled it, as explained below.
What we collect and why
| Information | Why we use it | Legal basis (EEA/UK) |
|---|---|---|
| Name, delivery and billing address, email, phone | To process, deliver and support your order and to send order emails | Performance of a contract |
| Order history, amounts, currency | To keep accounting and tax records and handle returns, withdrawals and refunds | Legal obligation; contract |
| Payment details | Entered directly with our payment service provider, which processes the payment and checks it for fraud. We receive only a confirmation, the payment type and, for cards, the last four digits. | Contract; legitimate interest in preventing fraud |
| Account login (only if you create an account) | To let you see your orders and save addresses | Contract |
| Messages and withdrawal notices you send us | To answer you and process your withdrawal or return | Contract; legal obligation; legitimate interest |
| Technical data (IP address, browser, pages requested) | Server logs to keep the site secure and working, and to limit spam on our forms | Legitimate interest |
We collect information directly from you, and we do not buy it from others. We do not use it for advertising, we do not sell it and we do not send marketing emails. You can browse the shop without giving us any personal information; to place an order we need your name and delivery details, so we cannot accept anonymous orders.
Automated decisions
Our payment service provider uses automated fraud screening when you pay. Based on your payment details, device and order information, it can decline a payment without a person reviewing it first. If your payment is declined and you think this is a mistake, contact us and we will help you complete the order another way. We do not use any other automated decision-making about you.
Who we share it with
- our payment service provider(s) (payments and fraud prevention);
- postal and courier companies, and customs authorities (delivery and customs declarations for your parcel);
- our website hosting and email providers.
We may also disclose information where the law requires it, for example to tax authorities or to a court.
Overseas disclosure
We are based in Australia. Your information is likely to be disclosed to recipients in the country you ship to (the carrier and customs authority that deliver your parcel), in the United States and the European Union (where our payment, hosting and email providers process data), and in the United Kingdom if you ship there. We take reasonable steps so that these recipients handle your information consistently with the APPs.
If you are in the EEA, Switzerland or the UK: the transfer of your order data to us in Australia is necessary to perform the contract you ask us to enter into (Article 49(1)(b) GDPR). Where our service providers transfer data internationally, they use safeguards such as the European Commission’s standard contractual clauses.
How long we keep it
- Order and accounting records: 7 years, as required by Australian tax law.
- Withdrawal and return records: 7 years, with the order.
- Customer account: until you ask us to close it.
- Messages: 2 years after the matter is closed.
- Server logs: up to 30 days.
Security
The whole site runs over HTTPS. Payment details go directly to our payment service provider, which is PCI DSS compliant. Access to customer information is limited to the people who need it to fulfil orders.
If a data breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and, where the EU or UK GDPR applies, the relevant supervisory authority.
Access, correction and your other rights
You can ask to access the personal information we hold about you and to correct it. We respond within 30 days and do not charge for a request.
If you are in the EEA, Switzerland or the UK, you also have the right to erasure, to restrict or object to processing and to data portability, and you can withdraw consent at any time where we rely on consent.
To use any of these rights, email support@arcavelle.shop. We may ask you to confirm your identity.
Complaints
If you have a concern about how we handled your information, email us first; we reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the EEA, you can also complain to the data protection authority in your country (for example Datatilsynet in Denmark, or the data protection authority of your federal state in Germany); in the UK, to the Information Commissioner’s Office; in Switzerland, to the Federal Data Protection and Information Commissioner.
Cookies
We use only cookies that are necessary for the shop to work: your bag, your currency, sign-in if you use an account, and fraud prevention at checkout. We do not use analytics or advertising cookies. Details are on our cookie policy.
Children
Our shop is not aimed at children, and we do not knowingly collect information from anyone under 16.
Changes to this policy
We will update this policy when the law or our practices change, and show the date of the latest version at the bottom of this page.
Last updated: 10 October 2026