Privacy and Data Handling Policy
Dolphy Australia Pty Ltd and its brands Dolphy Australia, Dolphy Linen, LinenCart, National Hotel Supplies and ShoppersSpot.
48 Whitfield Boulevard, Cranbourne West VIC 3977 · mayur@dolphy.com.au
Adopted 2 October 2026 · reviewed every 12 months and after any incident
1. What this policy covers
Personal information about our customers, buyers on the marketplaces we sell through (Amazon, eBay, Kogan, Big W, Temu, Harvey Norman and others) and our trade contacts: how we collect, use, protect and delete it. We follow the Australian Privacy Principles (Privacy Act 1988) and the data protection rules of each marketplace, including Amazon's Data Protection Policy.
2. What we collect and why
- Name, delivery address, phone, email – from our online stores, marketplaces and trade orders – to pack and deliver your order and contact you about it.
- Order details (items, prices, tracking) – for fulfilment, returns, accounting and tax.
- Trade contact and billing details – from trade customers – for quotes, invoices and account management.
We do not sell personal information, and we never use marketplace buyers' details for marketing.
3. Who we share it with
Only what is needed to deliver the order: couriers (Australia Post, StarTrack, Aramex, CouriersPlease, Direct Freight) receive the delivery name, address and phone; the marketplace the order came from; and our accounting system (Xero) for trade invoices. Nothing else, unless the law requires it.
4. How we classify information
- Restricted – Amazon buyer name, address, phone and email; passwords; system keys. Stored encrypted, seen only by staff who ship orders, every view logged, never exported except by the owner (logged).
- Confidential – other customer details, costs, supplier terms. Seen only by staff whose role needs it.
- Internal – products and stock levels. Staff.
5. How we protect it
- Our system, Dolphy Hub, is hosted on Railway and reachable only over encrypted HTTPS.
- Restricted data is encrypted in the database with AES-256-GCM; the key is held outside the database and only the owner can see or change it.
- Every person has their own named company login – no shared logins. Access is limited by role (Owner, Super admin, Manager, Warehouse, Sales team).
- Two-step sign-in is on for Dolphy Hub, Google Workspace and Railway.
- Staff computers have the firewall, full-disk encryption and automatic updates on.
- Company and customer data must not be copied to USB storage or personal devices.
- Test systems use made-up data only; live customer data is never copied into testing.
- Sign-ins, permission changes and every access to Amazon buyer data are logged; the owner reviews the Amazon buyer data access log every 14 days and records the review.
6. How long we keep it
- Amazon buyer name, address, phone and email are erased automatically 30 days after the order ships or is cancelled. The order, items, totals, tracking and suburb/state/postcode are kept for records and freight reporting.
- Other order and customer records are kept as long as needed for orders, returns, warranty, accounting and tax obligations, then deleted or anonymised.
- Backups are encrypted and kept on a fixed cycle (the last 30 days, plus one a month for 12 months), then deleted. Restricted data inside them stays encrypted.
7. If something goes wrong
- Contain – sign out all sessions, change affected keys and passwords, switch off the affected connection.
- Assess – use the audit and access logs to find what data and whose.
- Notify – Amazon (security@amazon.com) within 24 hours of discovering any incident involving Amazon data; affected people and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme applies.
- Fix and test – correct the cause and test the fix.
- Review – record what happened and update our controls and this policy.
Incident contact: Mayur, mayur@dolphy.com.au. We practise this plan once a year.
8. Your rights
You can ask what personal information we hold about you, and ask us to correct it, by emailing mayur@dolphy.com.au. Marketplace buyers can also contact the marketplace they bought through. If you are not satisfied, you can contact the OAIC (oaic.gov.au).