Privacy Policy
Last updated: 2 November 2026
Summary
- Who we are: Cavalletto, run by Bardar Pty Ltd, 163a Palmer Street, Darlinghurst NSW 2010.
- What we collect: the details you give us when you order or sign up, and information about how you use our website.
- Why: to deliver your orders, run our store and keep it secure, and, if you agree, to send you news and show you our ads.
- Who we share it with: the companies that help us run our store, such as our website host, our payment provider and delivery companies, and the marketing, analytics and advertising tools we use.
- Your rights: you can see, correct or delete your data, and stop marketing at any time.
- Questions: our Privacy Officer, Tom Hill, at tom@cavalletto.com.au.
Who we are
Cavalletto is run by Bardar Pty Ltd, a private company (Pty Ltd), based at 163a Palmer Street, Darlinghurst NSW 2010. ABN 61 664 482 384. We decide how personal data is used in our store, so we're responsible for it.
Our Privacy Officer is Tom Hill. You can reach them at tom@cavalletto.com.au, or by post at the address above.
What we collect
- When you order: your name, email address, delivery and billing addresses, what you buy and how you pay. Our payment provider handles your card details: we never see or store your full card number.
- If you create an account: your login details and order history.
- If you contact us: your messages and our replies.
- If you join our mailing list: your email address and name, if the signup form asks for it.
- When you use our website: your IP address, device and browser type, the pages you view and how you found us. We collect this with cookies and similar tools (see "Cookies").
We need your contact and delivery details to process your order. Everything else is optional.
Our store isn't meant for children under 16, and we don't knowingly collect their data.
Why we use it
| Why | What we use | Legal basis |
|---|---|---|
| To process, deliver and support your order | Order details | To carry out our contract with you |
| To keep tax and accounting records | Order and payment details | To meet our legal obligations |
| To keep our store secure and prevent fraud | Order details, IP address and device data | Our legitimate interest in a safe store |
| To send you news and offers by email | Email address | Your consent, or, if you've bought from us, our legitimate interest in telling you about similar products |
| To understand how our website is used and improve it | Website usage data | Your consent, where the law requires it, or our legitimate interest in improving our store |
| To show you our ads and measure how they perform | Website usage data and order activity | Your consent, where the law requires it |
Who we share it with
We share your data only with the companies that help us run our store, and only what each needs:
- Vercel hosts our website and processes your data for us.
- Airwallex runs our checkout and processes your payments for us. Airwallex also uses some data for its own purposes, such as preventing fraud and meeting its legal obligations, as its Privacy Policy explains.
- Delivery companies receive your name, address, phone number (if you give us one) and email so they can deliver your order.
- Marketing, analytics and advertising tools help us measure and improve our marketing and our website. They include advertising platforms, such as Meta (Facebook and Instagram), Google or TikTok, analytics tools, and our email marketing platform. They receive information about your visit and purchases, for example from a pixel or tag on our website, and, if you join our mailing list, your email address, so we can send you our emails, show you our ads, measure how they perform and see how our website is used. Each of them handles your data under its own privacy policy.
- Advertising partners: where an advertising partner and we decide together how data from our website is collected and sent to them, we're jointly responsible with that partner for collecting and sending it. The partner alone is responsible for how it uses the data after that, as its own privacy policy explains.
We don't sell your personal data for money. We also share data when the law requires it, for example with a tax authority.
Where your data goes
Our service providers store and process data outside Australia, including in the United States, Singapore, Japan, Malaysia, Belgium and the Netherlands. Where the law requires it, we protect your data with the safeguards it provides, such as the EU-US Data Privacy Framework and its UK extension, or approved standard contractual clauses.
How long we keep it
- Order and payment records: 5 years, because tax law requires it.
- Your account: until you ask us to close it.
- Messages: 2 years after we last hear from you.
- Mailing list: until you unsubscribe.
- Website usage data: up to 2 years.
Your rights
You can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- limit how we use it, or stop using it;
- send it to you or another company in a common format.
You can also object to how we use your data for our legitimate interests, and withdraw your consent at any time, including for marketing emails and cookies. Withdrawing doesn't affect what we did before.
To use any of these rights, email tom@cavalletto.com.au. We'll reply within one month. If we can't tell it's you, we'll ask you to confirm who you are first.
Marketing
We send marketing emails only if you've agreed to them, or if you've bought from us and we're telling you about similar products. Every email names our business and has an unsubscribe link, and we act on it within 5 business days.
Cookies
Cookies are small files a website stores in your browser. We use:
- Essential cookies, which make our store work, such as our checkout. These always run.
- Analytics cookies, which tell us how people use our store.
- Advertising cookies, which let our advertising partners show you our ads and measure them. These partners can collect information about your activity across different websites over time.
Where the law requires your consent, analytics and advertising cookies only run if you agree in our cookie banner. To change your choice, delete our website's cookies in your browser settings, and the banner will ask you again. You can also block cookies in your browser.
Keeping your data safe
Our store runs on an encrypted connection, and our payment provider meets the card industry's security standard (PCI DSS). Only the people who need your data to run our store can see it. If a data breach puts you at risk, we'll tell you, and the regulator, as the law requires.
Complaints
If you're unhappy with how we've handled your data, please tell us first at tom@cavalletto.com.au. We'll acknowledge your complaint within 30 days and tell you what we've done about it.
You can also complain to the Office of the Australian Information Commissioner (OAIC), oaic.gov.au, 1300 363 992 (from overseas +61 2 9942 4099).
Changes to this policy
When we change this policy, we'll update the date at the top. If a change affects how we use your data, we'll email our customers before it applies.
Contact
Privacy Officer: Tom Hill, tom@cavalletto.com.au
Post: Bardar Pty Ltd, 163a Palmer Street, Darlinghurst NSW 2010