Effective date: 30 October 2026. This policy explains how Crumpler Pty Ltd collects and uses personal data when you visit crumpler.com, buy from us, contact us or receive our marketing. It is written to meet the General Data Protection Regulation (GDPR) and the UK GDPR, and it applies to every Crumpler market. Shopify, which hosts our store, also processes your data for its own purposes; that is explained in section 11.
1. Who is responsible for your data
The data controller is Crumpler Pty Ltd (ABN 45 151 234 678), 1 Globe Alley, Melbourne VIC 3000, Australia. Email: bagtalk@crumpler.com.au.
Because we are not established in the EU, Crumpler Pty Ltd has appointed European Data Protection Office (EDPO) as its GDPR representative in the EU pursuant to Article 27 GDPR. You can contact EDPO regarding matters pertaining to the GDPR by using EDPO's online request form at https://edpo.com/gdpr-data-request/ or by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium. Pursuant to Article 27 of the UK GDPR, Crumpler Pty Ltd has appointed EDPO UK Ltd as its UK GDPR representative. You can contact EDPO UK regarding matters pertaining to the UK GDPR by using the online request form at https://edpo.com/uk-gdpr-data-request/ or by writing to EDPO UK at Unit 33, Waterside, Schooner Court, 44-48 Wharf Road, London N1 7UX, United Kingdom. We are not required to appoint a data protection officer.
2. What data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email, phone, billing and delivery address | You, at checkout, account creation, newsletter sign-up or customer service |
| Order and payment | Products bought, order value, currency, payment method, last four digits of your card, refund and return history | You and our payment providers (we never see your full card number) |
| Delivery and customs | Delivery address, tracking events, and any identification details customs authorities in your country require for clearance | You and our carriers |
| Account | Login credentials, saved addresses, order history, store credit balance | You |
| Customer service | Emails, live chat transcripts, social media messages, repair requests, phone call notes | You |
| Reviews and content | Product reviews, ratings, photos you upload | You |
| Marketing preferences | Subscription status, which emails you opened or clicked | You and our email platform |
| Device and browsing | IP address, device and browser type, pages viewed, products viewed and added to cart, referring site, approximate location | Cookies and pixels on our site, subject to your consent where required (section 10) |
To place an order we need your name, email address, delivery address and payment details; without them we cannot form the contract or deliver. Everything else is optional. If you enter someone else's details — for example a gift recipient's address — we use them only to deliver the order and to meet customs requirements, and this policy describes how we handle their data too; please make sure they are aware of it.
We do not ask for or knowingly collect special categories of data (such as health or religious data) or data about children under 16. If you are under 16 please do not use the site without a parent's involvement.
3. Why we use your data and the legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Taking your order, processing payment, dispatching and delivering it, clearing customs, sending order and shipping updates | Performance of a contract; legal obligation (customs and tax law) |
| Handling returns, refunds, exchanges, warranty claims and repairs | Performance of a contract; legal obligation (consumer law) |
| Answering your questions and resolving complaints | Performance of a contract; our legitimate interest in supporting customers |
| Fraud screening and payment security | Our legitimate interest in preventing fraud; legal obligation under payment rules |
| Sending marketing emails and SMS you have signed up for, including abandoned-cart reminders | Your consent, which you can withdraw at any time; for existing customers, where national law allows, our legitimate interest in marketing similar products with an opt-out in every message |
| Showing you personalised ads on Meta, Google, TikTok and similar platforms, and measuring whether ads lead to sales | Your consent, given through our cookie banner |
| Sharing a hashed version of your email address with advertising platforms to reach you or people like you | Your consent, given at sign-up or in your marketing preferences |
| Understanding how the site is used (analytics, session recordings, A/B tests) | Your consent for cookie-based tools; our legitimate interest for aggregated, non-identifying statistics |
| Inviting and publishing product reviews | Your consent; our legitimate interest in showing genuine reviews |
| Keeping accounting, tax and customs records | Legal obligation |
| Establishing, exercising or defending legal claims | Our legitimate interest |
Where we rely on legitimate interests we have checked that your interests do not override ours; you can ask for details of that assessment.
Automated decisions. Shopify and our payment providers score orders for fraud risk automatically. A flagged order is reviewed by a person before it is cancelled; we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share your data with
We share personal data with providers who process it on our instructions; with carriers, payment providers and advertising platforms, which act as independent controllers for their own purposes under their own policies; and with authorities where the law requires. We do not sell personal data.
| Role | Providers (location) |
|---|---|
| Store platform, hosting, checkout, fraud screening | Shopify (Shopify International Ltd, Ireland, and affiliates in Canada and the US) |
| Payments | Shopify Payments, powered by Stripe (Stripe Payments Europe Ltd, Ireland, and Stripe Inc., US), including Shop Pay, Apple Pay and Google Pay; PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) |
| Delivery, customs clearance and duty payment | DHL Express (Germany and global network), Starshipit (New Zealand), Zonos (US) |
| Customer service and live chat | Gorgias (US and France) |
| Email and SMS marketing | Klaviyo (US) |
| Returns portal | Loop Returns (US) |
| Product reviews | Junip (Canada) |
| Advertising and measurement | Meta Platforms Ireland, Google Ireland, TikTok Technology (Ireland), Aimerce, Elevar (US) |
| Analytics and reporting | Shopify Analytics, Google Analytics, Microsoft Clarity (US), RetentionX (Germany), Report Pundit, DataChamp, EZ Exporter |
| Accounting, invoicing and operations | Xero (New Zealand), Invoice Hero, Matrixify, monday.com, Trunk, Parex |
| Professional advisers and authorities | Lawyers, accountants, insurers, customs and tax authorities, courts and regulators where required |
If Crumpler or its assets are sold or restructured, your data may be transferred to the buyer, who must honour this policy.
5. International transfers
We are based in Australia, so the data you give us is held there and accessed by our team in Melbourne. Australia is not covered by an EU adequacy decision; the transfer of your data from Shopify's EU systems to us is governed by the European Commission's Standard Contractual Clauses in our data processing agreement with Shopify. Where we send data to another provider outside the EEA, we rely on an EU adequacy decision (for example for the UK, Canada, New Zealand, or US providers certified under the EU-US Data Privacy Framework) or on the Standard Contractual Clauses together with a transfer risk assessment and safeguards such as encryption in transit and at rest. For UK customers, the equivalent safeguard is the UK International Data Transfer Addendum to those clauses. You can ask us for a copy of the relevant clauses.
6. How long we keep your data
| Data | Retention |
|---|---|
| Orders, invoices, customs declarations, refunds | Up to 10 years after the order, as tax, customs and accounting law requires |
| Customer account | Until you close it, or after 3 years of inactivity, after which it is deleted or anonymised |
| Customer service correspondence | 3 years after the ticket is closed |
| Marketing data | Until you unsubscribe; we then keep your email on a suppression list so we do not contact you again |
| Fraud and chargeback records | 3 years from the order |
| Reviews | While the product is sold, unless you ask us to remove them |
| Cookie and pixel data | For the lifetime of each cookie (section 10); analytics data in Google Analytics is kept for a maximum of 14 months |
| Legal claims | For the applicable limitation period |
7. Your rights
You have the right to: access the personal data we hold about you and receive a copy; have inaccurate data corrected; have your data erased where we have no good reason to keep it; restrict how we use it in certain circumstances; receive the data you gave us in a portable format; object to processing based on legitimate interests; object at any time to direct marketing, which we will always honour; withdraw consent at any time, without affecting earlier processing; and not be subject to decisions based solely on automated processing that significantly affect you.
To exercise any right, email bagtalk@crumpler.com.au or write to the address in section 1, or contact our EU representative. We may ask you to confirm your identity. We respond within one month, extendable by two months for complex requests, and we will tell you if we extend. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You can also unsubscribe using the link in any marketing email, reply STOP to any SMS, change your cookie choices through Cookie preferences in the website footer, and manage data Shopify holds about you at privacy.shopify.com.
If you are unhappy with how we handle your data you can complain to the data protection authority in your country; a list is published by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en; in the UK it is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.
8. Marketing
We send marketing emails and SMS only if you have opted in, or if you are an existing customer and the law of your country permits us to tell you about similar products with an opt-out in every message. Sign-ups from EU addresses use double opt-in: you must confirm your subscription by clicking the link we email you. Every email has an unsubscribe link, and you can unsubscribe at any time by emailing us.
We use Klaviyo to send messages and to see which messages are opened and clicked. With your cookie consent, Klaviyo also links your browsing on our site (products viewed, items left in your cart) to your profile so we can send relevant reminders. Only if you have agreed to it at sign-up or in your marketing preferences, we share a hashed (scrambled) version of your email address with Meta, Google and TikTok so they can show our ads to you or to people with similar interests; you can withdraw that agreement at any time and we will remove you from those audiences.
9. Security
We protect your data with encryption in transit (TLS), access controls, staff training and vetted providers. Payments are handled by PCI-DSS certified providers. No system is perfectly secure; if a breach is likely to put you at high risk we will notify you and the relevant authority as the law requires.
10. Cookies and similar technologies
We use cookies, pixels and similar technologies on crumpler.com. In the EU, EEA and UK we set only strictly necessary cookies until you make a choice in our cookie banner; everything else waits for your consent, which you can give, refuse or change at any time via Cookie preferences in the footer. Refusing non-essential cookies does not stop you shopping.
| Category | What it does | Examples (set by) | Lifetime |
|---|---|---|---|
| Strictly necessary | Keeps your cart, login, language, currency and security working; records your cookie choice |
cart (Shopify, 2 weeks), localization and secure_customer_sig (Shopify, 1 year), _tracking_consent (Shopify, 1 year); Gorgias chat session (session) |
Session to 1 year |
| Analytics | Measures how the site is used so we can improve it; session replays and heatmaps |
_shopify_y (1 year) and _shopify_s (30 minutes) for Shopify Analytics; _ga and _ga_* (Google Analytics, 2 years); _clck (1 year) and _clsk (1 day) for Microsoft Clarity; RetentionX |
30 minutes to 2 years |
| Marketing | Shows and measures ads on other platforms; connects your browsing to your email profile for reminders |
_fbp and _fbc (Meta, 90 days); _gcl_au (Google Ads, 90 days); _ttp (TikTok, 13 months); __kla_id (Klaviyo, 2 years); Aimerce first-party identifier |
90 days to 2 years |
| Preferences | Remembers choices such as the store region suggested to you | Orbe geolocation (up to 1 year) | Up to 1 year |
This table lists the main cookies; the full, current list is shown in the cookie preferences panel. Embedded content from other services (for example the SoundCloud player on Crumpler Radio) may set its own cookies when you interact with it, under that service's policy. We honour the Global Privacy Control signal where the law gives it effect.
11. Shopify and other independent controllers
Our store runs on Shopify. Shopify processes your data on our behalf to run the store, and also for its own purposes — for example to operate Shop Pay, to protect merchants against fraud across its network, and, where you have consented, to improve advertising across Shopify stores. For those purposes Shopify is an independent controller, and its Consumer Privacy Policy at shopify.com/legal/privacy/customers explains how it uses your data and how to exercise your rights with Shopify directly. Our payment providers, carriers, Meta, Google and TikTok likewise act as independent controllers for their own uses of data under their own policies.
12. Changes to this policy
We will post any changes here and update the effective date. If a change materially affects how we use your data, we will tell you by email or a notice on the site before it takes effect.
13. Contact
Crumpler Pty Ltd, 1 Globe Alley, Melbourne VIC 3000, Australia · bagtalk@crumpler.com.au · EU representative: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium — edpo.com/gdpr-data-request · UK representative: EDPO UK Ltd, Unit 33, Waterside, Schooner Court, 44-48 Wharf Road, London N1 7UX, United Kingdom — edpo.com/uk-gdpr-data-request.