Privacy policy

Bloom Within Jewellery is an Australian emotional jewellery brand operated by CANBERRA FAMILY MATCHING DESIGN PTY LTD, ABN 62 657 850 050, of 30 Fitzhardinge Cres, Evatt ACT 2617 (Bloom Within, we, us or our). We operate bloomwithinjewellery.com and related customer, social media and promotional activities.

Our privacy contact is hello@bloomwithinjewellery.com. If you need this Policy in another accessible format, contact us and we will take reasonable steps to provide it.

This Privacy Policy explains how we collect, hold, use and disclose personal information when you visit or buy from our Shopify store, create an account, subscribe to marketing, contact us, request bespoke jewellery, leave a review, interact with our social channels, or enter The Shared Bloom promotion.

We aim to handle personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where those laws apply to us, we will comply with them. Other privacy laws may also apply depending on where you live or where our services are offered.

This Policy does not govern how TikTok, Shopify, payment providers, delivery carriers or other independent third parties use information for their own purposes. Their own privacy notices also apply.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. It may include a name, contact details, online identifier, order history or information linked to a social media account.

Sensitive information is a more protected category and can include health information. We do not ask for sensitive information in public comments. If information about a known metal sensitivity is genuinely needed for safe and wearable manufacture, Section 7 explains the limited private process we use.

4.1 Information you provide directly

• Identity and contact information: name, email address, telephone number, billing and delivery address.
• Account information: login details, account preferences and saved customer information.
• Order and transaction information: products, customisation choices, order value, payment status, refunds, returns and correspondence. Full card details are generally handled by Shopify or the relevant payment provider; we may receive limited payment and transaction information.
• Delivery information: recipient name, address, contact details, delivery instructions and tracking information.
• Bespoke and sizing information: jewellery preferences, engraving text, ring or bracelet size, materials, design brief, reference images and approval communications.
• Customer service information: enquiries, feedback, complaints, warranty matters, returns and any attachments you choose to send.
• Marketing preferences: newsletter subscription, consent records, campaign interactions and opt-out status.
• Content you submit: product reviews, photographs, comments, testimonials or other user-generated content, subject to any separate permission or licence.
• Promotion information: the information described in Section 6 for The Shared Bloom or another clearly identified promotion.

4.2 Information collected automatically

• Device and connection information, such as IP address, browser, operating system, device identifiers, language and approximate location derived from IP.
• Store activity, such as pages viewed, links clicked, search terms, cart activity, checkout events, referral source and session timestamps.
• Cookie and similar technology information used for essential store functions, preferences, security, analytics and, where enabled and permitted, advertising measurement.
• Fraud and security signals associated with an account, device, payment attempt, address or transaction.

4.3 Information from other sources

We may receive information from Shopify, payment providers, shipping and fulfilment providers, analytics services, social media platforms when you interact with our official account, and people acting with your authority. We may also receive publicly available information, such as a public TikTok handle and a comment made on an official promotion post.

We collect personal information directly from you through checkout, forms, email, direct messages, account tools, subscriptions, reviews, bespoke consultations and promotion processes. We also collect some information automatically through our Shopify store and configured technologies, or from service providers and public social media interactions.

Information may be held in Shopify, our business email and cloud systems, payment and shipping systems, marketing and analytics tools, secure working files, and limited paper records where necessary. We seek to avoid duplicating identity documents or sensitive information across systems.

6.1 At the public entry stage

For an entry made by commenting on an official Bloom Within TikTok theme post, we collect the entrant's public TikTok handle, public comment, theme, comment URL or identifier, timestamp, moderation status and judging record. TikTok comments are public and may be seen, copied or shared by other users under TikTok's own settings and policies.

We do not ask entrants to disclose a private personal story, a finished jewellery design, medical information, family details or information about children. If a comment contains unnecessary private or sensitive information, we may hide, remove, exclude, redact or securely delete our copy where reasonably practicable.

6.2 If you are a provisional selected contributor

We will contact you privately through Bloom Within's official TikTok account. We may then request only the information reasonably needed to verify eligibility and create and deliver the prize, including:

• legal name and confirmation that you are at least 18 years old and an Australian resident;
• limited evidence of age or residency, with unnecessary document numbers or fields redacted where possible;
• email address, telephone number and delivery address;
• ring, bracelet, necklace or other relevant sizing and wearability information;
• signature on the Inspiration Release and related production approval records;
• your preferred public credit: legal name, TikTok handle, first name only or anonymous; and
• only if genuinely needed, a private statement about a known metal sensitivity, handled under Section 7.

6.3 How promotion information is used

We use promotion information to receive and moderate entries, check eligibility, conduct judging, keep an audit record, contact provisional selected contributors, obtain permissions, develop and manufacture the jewellery, provide progress updates, arrange delivery, announce outcomes with the contributor's chosen credit, resolve disputes and meet legal obligations.

We do not select entries by likes, chance or automated profiling. Judges score eligible entries against the published criteria. Where practical, the entrant's handle is concealed during first-round scoring.

6.4 Public credit and creative records

A selected contributor controls how they are publicly credited: legal name, TikTok handle, first name only or anonymous. The original public comment and any separate Inspiration Release are also subject to The Shared Bloom Full Terms and Conditions. Bloom Within's sketches, CAD files, prototypes and final jewellery design are business and creative records; any personal information within those records remains covered by this Policy.

We do not provide medical advice and we do not ask for diagnoses or medical histories. If a known metal sensitivity is relevant to safe and wearable manufacture, we will ask privately, explain why the information is needed, seek express and specific consent, and collect only the minimum information reasonably necessary to discuss a suitable material or alternative piece.

You may decline to provide sensitive information. If we cannot safely or reasonably manufacture the proposed piece without it, we will discuss another material or an alternative prize of equal or greater value where applicable. We will not use metal-sensitivity information for marketing, public storytelling or unrelated profiling.

• to operate, secure and improve our website and customer accounts;
• to process payments, orders, refunds, returns, exchanges and warranties;
• to design, approve, manufacture, personalise, package and deliver jewellery;
• to answer enquiries, provide customer service and manage complaints;
• to administer judged promotions, including The Shared Bloom;
• to send service messages, order updates, safety information and policy notices;
• to send marketing where we have consent or are otherwise permitted, and to record opt-outs;
• to measure store performance, understand customer journeys and improve content;
• to detect fraud, misuse, security incidents and technical problems;
• to protect our rights, customers, team and community; and
• to comply with tax, accounting, consumer, privacy and other legal obligations, and respond to lawful requests.

We will not use or disclose personal information for a materially different purpose unless you would reasonably expect it, you consent, or the use or disclosure is otherwise permitted or required by law.

You may browse much of our website without identifying yourself. However, if required information is not provided, we may be unable to create an account, process payment, fulfil or deliver an order, respond to an enquiry, provide a bespoke service, verify promotion eligibility or manufacture and deliver a selected prize. Optional fields should be clearly marked where practicable.

Our Shopify store uses cookies and similar technologies. Essential technologies support functions such as security, cart, checkout, account access, language and preferences. With the settings and permissions that apply to you, we may also use analytics or advertising technologies to understand visits, measure campaigns and improve relevance.

You can manage available choices through our cookie banner or browser settings. Blocking essential cookies may prevent parts of the store from working. We will configure Shopify Customer Privacy settings and any consent banner to reflect the technologies actually enabled on the store.

We do not sell personal information for money. Some analytics or advertising disclosures may be treated as a 'sale', 'sharing' or targeted advertising under certain overseas laws. If such laws apply and those technologies are enabled, we will provide the required notice and choice.

We send promotional email or SMS only where we have consent or are otherwise permitted by law. A purchase or enquiry does not automatically mean that you have subscribed to marketing. Marketing messages will identify Bloom Within and include a clear unsubscribe method.

You may unsubscribe at any time using the link in a message or by emailing hello@bloomwithinjewellery.com. We will action valid electronic marketing opt-outs within the legally required period and may retain a limited suppression record so that we do not contact you again by mistake. Unsubscribing does not stop necessary service messages about an order, account, promotion or legal notice.

We disclose only the information reasonably needed for the relevant purpose. Recipients may include:

• Shopify and its affiliates and subprocessors for ecommerce hosting, checkout, store operations, security and related services;
• payment providers, banks and fraud-prevention services;
• jewellers, manufacturers, engravers, photographers or production partners, using only the details needed to make or document a product;
• shipping, postal, courier, fulfilment and address-validation providers;
• email, customer support, cloud storage, website, analytics and advertising service providers actually enabled by us;
• professional advisers, insurers, auditors and dispute-resolution providers;
• regulators, courts, law enforcement or other persons where required or authorised by law;
• a buyer, successor or adviser in connection with a proposed or completed sale, restructure or transfer of the business, subject to appropriate confidentiality and legal requirements; and
• another person where you direct us or give valid consent.

For The Shared Bloom, delivery and sizing information is shared only with service providers reasonably required to manufacture or deliver the prize. We do not give a selected contributor's identity or private information to other entrants.

Bloom Within is based in Australia, but our ecommerce and technology providers may process or store personal information outside Australia. Shopify is a Canadian company and its group companies and subprocessors may process information in countries including Canada, the United States and Singapore. Other providers may operate in additional countries depending on the services actually enabled.

Where Australian privacy law applies to an overseas disclosure, we take reasonable steps required in the circumstances to protect the information. Overseas recipients may be subject to different laws, and those laws may allow government or regulatory access. We will update this Policy if our usual overseas disclosure practices materially change.

We keep personal information only for as long as reasonably needed for the purposes described in this Policy, including legal, tax, accounting, consumer, warranty, security and dispute requirements. We then take reasonable steps to delete or de-identify it, subject to technical backup cycles and lawful retention obligations.

A public TikTok comment may remain on TikTok until the account holder or platform removes it. Removing a comment from TikTok does not automatically delete a separate record that Bloom Within lawfully needs for judging, audit or dispute purposes.

We take reasonable technical and organisational steps appropriate to our size, systems and the sensitivity of the information. These may include restricted access, account permissions, multi-factor authentication where available, secure service providers, encrypted connections, device security, backups, staff or contractor confidentiality, data minimisation and periodic review of stored information.

No internet transmission or storage system is completely secure. You are responsible for keeping account credentials confidential and for contacting us promptly if you suspect unauthorised access or a fraudulent message claiming to be Bloom Within.

Where lawful and practicable, you may browse or make a general enquiry without using your full legal name. We may need identifying information for payment, delivery, age or residency verification, fraud prevention, consumer claims or other legal and operational purposes. A selected The Shared Bloom contributor may choose anonymous public credit even though private eligibility verification is required.

You may request access to personal information we hold about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Email hello@bloomwithinjewellery.com with the subject 'Privacy request'.

We may need to verify your identity using information proportionate to the request. We aim to respond within 30 calendar days. Access is generally provided free of charge; if a lawful, non-excessive cost is necessary for giving access, we will explain it before proceeding. If access or correction is refused where permitted, we will provide written reasons and available complaint options unless it would be unreasonable or unlawful to do so.

You may ask us to delete information, withdraw a consent, stop a particular optional use, or provide information about our source of your details. We will consider the request under applicable law and our operational and legal obligations. We may need to retain information for tax, accounting, fraud, consumer, dispute, legal or suppression purposes.

Withdrawing consent does not affect handling that occurred lawfully before withdrawal. If consent is necessary for an optional service, promotion step or use of sensitive information, withdrawal may mean we cannot continue that activity.

If we become aware of a suspected data breach, we will contain and assess it, take reasonable remedial steps, document the response and notify affected individuals and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme applies and notification is required. If another privacy law applies, we will also follow its applicable notification requirements.

The Shared Bloom is open only to eligible Australian residents aged 18 years or older. Our store is intended for customers who can lawfully enter into a purchase. We do not knowingly seek personal information directly from children and we do not want entrants or customers to disclose children's or family members' information unnecessarily.

If you believe a child has provided personal information to us without appropriate authority, contact hello@bloomwithinjewellery.com so we can assess and take reasonable action.

Shopify, payment providers or security services may use automated tools to identify fraud, security risks or unusual activity. These tools may use transaction, account, device, network, payment and delivery signals and may flag an order for review, verification, delay or cancellation.

Bloom Within does not use automated tools to judge The Shared Bloom. We do not currently arrange for a computer program to make a significant decision about an individual without meaningful human involvement, other than automated platform or provider controls that may be necessary to prevent fraud or secure a transaction. Where practicable, we review significant adverse outcomes and provide a way to contact us. If our use of automated decisions materially changes, we will update this Policy with the types of information and decisions involved.

Our website and communications may link to TikTok, Instagram, Pinterest, payment services, delivery tracking or other third-party sites. We do not control their independent privacy practices. Review their privacy notices and settings before providing information. A link does not mean that Bloom Within is responsible for a third party's handling of information.

If you believe we have mishandled your personal information, contact our Privacy Contact at hello@bloomwithinjewellery.com with:

• your name and preferred contact details;
• a clear description of what happened and when;
• any relevant order, account or promotion reference; and
• the outcome you are seeking.

We will acknowledge the complaint as soon as reasonably practicable, investigate fairly, keep an appropriate record and aim to provide a substantive response within 30 calendar days. If we need more time, we will explain why and provide an updated timeframe.

If the Privacy Act applies and you are not satisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner (OAIC): oaic.gov.au/privacy/privacy-complaints

We may update this Policy when our systems, service providers, products, promotions or legal obligations change. The current version will be published on our website with an updated date. If a change is material, we will take reasonable steps to give additional notice, particularly where the change affects an existing use of personal information.

Privacy Contact — write to us and we will respond as described in Sections 17 and 23.