Your Data Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs):

• APP 1 — open and transparent management of personal information. See our Privacy Policy.
• APP 6 — we use your information only for the purpose we collected it (fulfilling your order, providing customer service), unless you consent otherwise.
• APP 12 — you can request access to the personal information we hold about you. We respond within 30 days. Free of charge.
• APP 13 — you can request correction of inaccurate information at any time.
• Notifiable Data Breaches scheme — if your data is involved in a breach likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) within 72 hours.
• You may lodge a complaint with the OAIC at oaic.gov.au if you believe we have mishandled your data.

Under the EU GDPR and UK GDPR, you have the right to:

• Access — get a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — request deletion in certain circumstances
• Restrict processing — temporarily limit our use of your data
• Data portability — receive your data in a structured, machine-readable format
• Object — to processing based on legitimate interests or direct marketing
• Withdraw consent — at any time, for any consent-based processing
• Lodge a complaint with your local supervisory authority

Under the California Consumer Privacy Act (CCPA) and CPRA, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information (with limited exceptions)
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information — we do not sell data, but you can opt out of cross-context behavioural advertising
• Limit use of sensitive personal information
• Non-discrimination for exercising any of these rights

Email privacy@aratrikkaz.com from the email address on your account. Tell us which right you wish to exercise. We will respond within 30 days (or sooner where required by your jurisdiction).

We may need to verify your identity before acting on your request to prevent fraud — this is for your protection.

• Credit card details — handled directly by Stripe; we never see them
• Biometric data
• Government identifiers (driver's licence, passport) — except where legally required for international shipping customs declarations
• Health information
• Children's data — our service is not directed at people under 16