Privacy policy
This Privacy Policy explains how Xotic Mushrooms (xoticmushrooms.com.au, the "Site", "we" or "us") collects, uses, stores and discloses your Personal Information when you visit the Site, make a purchase, or contact us about retail, wholesale, white label or private label supply. We handle Personal Information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where they apply to you, the EU and UK General Data Protection Regulation (GDPR).
Contact
If you have questions about this policy, want more information about our privacy practices, or would like to make a complaint, please contact us:
- Email: xoticmushrooms@gmail.com
- Mail: 5/337 Settlement Road, Thomastown VIC 3074, Australia
Personal Information we collect
In this policy, "Personal Information" means any information about an identified or reasonably identifiable individual. We collect the following.
Device information
- What we collect: browser version, IP address, time zone, cookie information, pages and products you view, search terms, and how you interact with the Site.
- How we collect it: automatically, using cookies, log files, web beacons, tags and pixels.
- Why: to load the Site correctly for you and to understand how the Site is used so we can improve it.
- Who we share it with: our platform provider Shopify, and our analytics and advertising providers (Google and Meta) where you have consented to those cookies.
Order information
- What we collect: name, billing address, shipping address, email address, phone number and payment details. Card and other payment details are processed by our payment providers; we do not store full card numbers.
- How we collect it: from you, when you place an order.
- Why: to fulfil your order, process payment, arrange shipping, send invoices and order confirmations, communicate with you, screen orders for fraud and, where you have agreed, send you information about our products.
- Who we share it with: Shopify, our payment gateways, and the shipping and delivery providers we use to send your order.
Customer support and business enquiries
- What we collect: your name, email address, phone number, business name and details, and anything you include in your message, such as product, formulation or packaging requirements for white label or private label enquiries.
- How we collect it: from you, when you email us, use a form on the Site or speak with us.
- Why: to answer your enquiry, prepare quotes and samples, and provide customer support.
- Who we share it with: Shopify and our email provider, and, where needed to fulfil a supply agreement, our packaging, testing and freight partners.
Minors
The Site is not intended for individuals under the age of 18. We do not knowingly collect Personal Information from children. If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us using the details above and we will delete it.
Sharing Personal Information
We share Personal Information with service providers who help us run our business and fulfil our contracts with you, as described above. For example:
- We use Shopify to power our online store. You can read how Shopify uses Personal Information in the Shopify privacy policy.
- We use payment gateways to process payments and couriers to deliver orders.
- We may share Personal Information to comply with applicable laws and regulations, to respond to a lawful request such as a subpoena or search warrant, or to protect our rights.
Some of these providers store or process information outside Australia, including in Canada, the United States and Ireland. We take reasonable steps to make sure they protect your information in a way that is consistent with the Australian Privacy Principles.
We do not sell your Personal Information.
Analytics and advertising
With your consent, we use your Personal Information to understand how the Site is used and to show you advertising we believe may interest you. For example:
- We use Google Analytics to understand how customers use the Site. You can read the Google privacy policy and opt out of Google Analytics.
- We use advertising tools from Meta (Facebook and Instagram) and Google, which may use cookies and pixels to measure our ads and show you relevant ads on other websites.
You can opt out of targeted advertising through your Facebook ad settings, your Google ad settings, the Digital Advertising Alliance opt-out portal, or by declining advertising cookies in our cookie banner. To learn more about how targeted advertising works, see the Network Advertising Initiative.
Using Personal Information
We use your Personal Information to provide our products and services to you. This includes selling products, processing payments, shipping and fulfilling orders, responding to enquiries, and, where you have agreed, keeping you up to date on new products, services and offers. You can unsubscribe from marketing emails at any time using the link in each email.
Lawful basis (EEA and UK residents)
If you are a resident of the European Economic Area or the United Kingdom, we process your Personal Information under the following lawful bases under the GDPR:
- your consent;
- the performance of the contract between you and us;
- compliance with our legal obligations;
- our legitimate interests, where these do not override your fundamental rights and freedoms.
Retention
When you place an order, we keep your Personal Information for our records for as long as needed to fulfil the order and meet our legal, tax and accounting obligations, unless you ask us to delete it and we are not required to keep it.
Automated decision-making
We do not engage in fully automated decision-making that has a legal or similarly significant effect on you. Our platform provider Shopify uses limited automated decision-making to prevent fraud, which does not have a legal or similarly significant effect on you. This includes:
- temporarily blocking IP addresses associated with repeated failed transactions, for a small number of hours;
- temporarily blocking credit cards associated with blocked IP addresses, for a small number of days.
Security
We take reasonable steps to protect your Personal Information from misuse, interference, loss, and unauthorised access, modification or disclosure. Payments are handled by secure, PCI-compliant payment providers.
Your rights
You can ask to access the Personal Information we hold about you and ask us to correct it if it is inaccurate, out of date or incomplete. Please contact us using the details above. We will respond within a reasonable time, usually within 30 days.
If you are a resident of the EEA or UK, you also have the right to ask that your Personal Information be erased, to receive it in a portable format, and to object to or restrict certain processing.
If you are a resident of California, you have the right to know what Personal Information we hold about you, to ask that it be corrected or deleted, and to designate an authorised agent to make these requests on your behalf. We do not sell Personal Information for money. Our use of advertising cookies may count as "sharing" under the California Consumer Privacy Act; you can opt out by declining advertising cookies or contacting us.
Cookies
A cookie is a small file downloaded to your computer or device when you visit the Site. Cookies help the Site remember your actions and preferences, such as items in your cart, so you don't have to re-enter them, and show us how people use the Site. We use necessary cookies for the store to work and, with your consent, analytics and advertising cookies.
Cookies necessary for the store to work
| Name | Function | Duration |
|---|---|---|
| _ab | Used in connection with access to admin. | 2y |
| _secure_session_id | Used in connection with navigation through a storefront. | 24h |
| _shopify_country | Used in connection with checkout. | session |
| _shopify_m | Used for managing customer privacy settings. | 1y |
| _shopify_tm | Used for managing customer privacy settings. | 30min |
| _shopify_tw | Used for managing customer privacy settings. | 2w |
| _storefront_u | Used to facilitate updating customer account information. | 1min |
| _tracking_consent | Tracking preferences. | 1y |
| c | Used in connection with checkout. | 1y |
| cart | Used in connection with shopping cart. | 2w |
| cart_currency | Used in connection with shopping cart. | 2w |
| cart_sig | Used in connection with checkout. | 2w |
| cart_ts | Used in connection with checkout. | 2w |
| cart_ver | Used in connection with shopping cart. | 2w |
| checkout | Used in connection with checkout. | 4w |
| checkout_token | Used in connection with checkout. | 1y |
| dynamic_checkout_shown_on_cart | Used in connection with checkout. | 30min |
| hide_shopify_pay_for_checkout | Used in connection with checkout. | session |
| keep_alive | Used in connection with buyer localization. | 2w |
| master_device_id | Used in connection with merchant login. | 2y |
| previous_step | Used in connection with checkout. | 1y |
| remember_me | Used in connection with checkout. | 1y |
| secure_customer_sig | Used in connection with customer login. | 20y |
| shopify_pay | Used in connection with checkout. | 1y |
| shopify_pay_redirect | Used in connection with checkout. | 30 minutes, 3w or 1y depending on value |
| storefront_digest | Used in connection with customer login. | 2y |
| tracked_start_checkout | Used in connection with checkout. | 1y |
| checkout_one_experiment | Used in connection with checkout. | session |
Reporting and analytics cookies
| Name | Function | Duration |
|---|---|---|
| _landing_page | Track landing pages. | 2w |
| _orig_referrer | Track landing pages. | 2w |
| _s | Shopify analytics. | 30min |
| _shopify_d | Shopify analytics. | session |
| _shopify_s | Shopify analytics. | 30min |
| _shopify_sa_p | Shopify analytics relating to marketing and referrals. | 30min |
| _shopify_sa_t | Shopify analytics relating to marketing and referrals. | 30min |
| _shopify_y | Shopify analytics. | 1y |
| _y | Shopify analytics. | 1y |
| _shopify_evids | Shopify analytics. | session |
| _shopify_ga | Shopify and Google Analytics. | session |
| _ga, _ga_* | Google Analytics, used to distinguish visitors and sessions. | 2y |
| _fbp | Meta (Facebook) pixel, used to measure and deliver ads. | 3 months |
Session cookies last until you stop browsing. Persistent cookies last until they expire or are deleted; most of ours expire between 30 minutes and two years after they are set.
You can control and delete cookies through your browser settings, usually under "Settings", "Privacy" or "Preferences". Blocking cookies may affect how the Site works. You can learn more at www.allaboutcookies.org. Blocking cookies may not completely stop us sharing information with advertising partners; to opt out of those uses, see "Analytics and advertising" above.
Do Not Track
Because there is no consistent industry understanding of how to respond to "Do Not Track" signals, we do not change our data collection and use practices when we detect one from your browser.
Changes
We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal or regulatory reasons. The date below shows when it was last updated.
Complaints
If you would like to make a complaint, please contact us by email or mail using the details under "Contact" above. We will acknowledge your complaint and aim to resolve it within 30 days.
If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC). If you live in the EEA or UK, you can also contact your local data protection authority.
Last updated: 22 October 2026