Privacy policy
Last updated: 8 September 2026
Effective for: Phantom ("Phantom", "we", "us", "our")
Phantom operates this store and website, including all related information, content, features, tools, products and services (the "Services"), to provide you with a curated shopping experience. Our Services are hosted using Shopify, which helps us run our online store. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit, use, or make a purchase through the Services, or otherwise communicate with us.
This Privacy Policy is intended to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in respect of the collection, handling and disclosure of your personal information.
By using the Services, you acknowledge that you have read this Privacy Policy and understand how we collect, use and disclose your personal information as described below.
1. PERSONAL INFORMATION WE COLLECT
"Personal information" has the meaning given in the Privacy Act 1988 (Cth) - broadly, information or an opinion about an identified individual, or an individual who is reasonably identifiable. It does not include information that has been de-identified so that no individual can reasonably be identified from it.
Depending on how you interact with the Services, we may collect the following categories of personal information:
- Contact details - name, billing and shipping address, phone number, and email address.
- Financial information - payment card details, financial account information, transaction details and payment confirmations. Full card numbers are processed by our payment processor and are not stored on our systems.
- Account information - username, password, and account preferences.
- Transaction information - items viewed, added to cart or wishlist, purchases, returns, exchanges and order history.
- Communications - details you provide when contacting customer support or otherwise communicating with us.
- Device and usage information - IP address, browser and device type, and information collected through cookies and similar technologies.
How we collect it:
- Directly from you - when you create an account, browse or use the Services, place an order, or contact us.
- Automatically - through cookies and similar technologies when you use the Services.
- From our service providers - such as Shopify and other providers who help us operate the Services (see section 4).
2. HOW WE USE YOUR PERSONAL INFORMATION
We collect, hold and use your personal information only for purposes that are reasonably necessary for, or directly related to, our business as an online retailer, including to:
- Provide and manage the Services - process orders, payments, deliveries, returns and exchanges, manage your account, and provide customer support.
- Marketing - send you marketing communications about products, promotions and offers, where you have consented or as otherwise permitted under the Spam Act 2003 (Cth). You can opt out at any time (see section 7).
- Security and fraud prevention - verify your identity, protect your account, and detect and prevent fraud or unlawful activity.
- Communicate with you - respond to your enquiries and maintain our relationship with you.
- Legal compliance - comply with our legal obligations, respond to lawful requests from regulators or law enforcement, and enforce our terms and policies.
3. HOW WE DISCLOSE PERSONAL INFORMATION
We may disclose your personal information to the following categories of third parties for the purposes described above:
- Service providers - Shopify and other providers who help us run the Services, such as payment processing, IT hosting, delivery and fulfilment, and customer support.
- Marketing and advertising partners - if you consent to personalised advertising, we may share limited information with marketing partners for that purpose. You can withdraw this consent at any time (see section 7).
- At your direction - where you ask us to share your details, for example to arrange delivery or through a third-party login.
- Business transfers and legal requirements - if Phantom is involved in a merger, acquisition, or sale of assets, or to comply with a legal obligation, court order, or to protect the rights, property or safety of Phantom, our customers, or others.
We do not sell your personal information to third parties.
4. OVERSEAS DISCLOSURE OF PERSONAL INFORMATION
Our Services are hosted using Shopify's infrastructure, and we use other service providers (such as payment processors, delivery partners, and marketing platforms) who may store or process personal information outside Australia. Personal information may therefore be sent to, and processed in, countries including the United States, Canada, and other countries in which Shopify or our service providers operate.
Before disclosing personal information to an overseas recipient, we take reasonable steps, as required by Australian Privacy Principle 8, to ensure the recipient handles that information consistently with the APPs - for example, by relying on contractual protections with our service providers. Where reasonably practicable, we will notify you of the countries in which recipients of your personal information are likely to be located if you request this information from us.
To learn more about how Shopify handles personal information, you can review the Shopify Privacy Policy at https://www.shopify.com/legal/privacy.
5. COOKIES AND SIMILAR TECHNOLOGIES
We and our service providers use cookies and similar technologies to operate the Services, remember your preferences, understand how the Services are used, and, where you consent, to support advertising. You can control or disable cookies through your browser settings, though some features of the Services may not function properly if you do so.
6. DATA SECURITY AND RETENTION
We take reasonable technical and organisational steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure, as required by Australian Privacy Principle 11. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to maintain your account, provide the Services, meet legal and accounting requirements, and resolve disputes. Where personal information is no longer needed for these purposes, we will take reasonable steps to destroy or de-identify it.
7. YOUR RIGHTS AND CHOICES
Under the Privacy Act 1988 (Cth), you have the right to:
- Access - request access to the personal information we hold about you.
- Correction - request that we correct any personal information that is inaccurate, out of date, incomplete, or misleading.
- Request restriction of use - if you have made a complaint about a breach of the APPs, you may request that we not use or disclose the relevant information while your complaint is being handled, in certain circumstances.
- Manage marketing preferences - opt out of marketing communications at any time using the unsubscribe link in our emails, or by contacting us. You may still receive non-promotional messages, such as order and account updates.
To exercise any of these rights, please contact us using the details in section 10. We may need to verify your identity before responding to your request, and we will respond within a reasonable period (generally within 30 days). In some circumstances permitted by law, we may decline a request - if so, we will explain why.
8. DATA BREACH NOTIFICATION
If we experience a data breach involving personal information that is likely to result in serious harm to affected individuals, we will comply with our obligations under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth), including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as required.
9. COMPLAINTS
If you have a concern or complaint about how we have handled your personal information, please contact us using the details in section 10. We will investigate your complaint and aim to respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
10. CONTACT US
If you have any questions about this Privacy Policy or would like to exercise any of your rights, please contact us:
- Email: info@phantomau.com
11. CHILDREN'S PRIVACY
The Services are not directed at children, and we do not knowingly collect personal information from children without the consent of a parent or guardian. If you believe we have inadvertently collected personal information from a child, please contact us so we can delete it.
12. THIRD-PARTY LINKS
The Services may contain links to third-party websites or platforms. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing them with any personal information.
13. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the updated policy on this website and update the "Last updated" date above.