Privacy policy

This policy says what we collect, why, who sees it, and how long we keep it. It is written to be read once and understood, not to be long.

We are a small independent bookshop. We collect what an order needs, and we do not sell anything about you to anybody.

What we collect when you order

• your name
• your email address
• your delivery address
• your phone number, if you give one
• anything you write in the order notes

That is what a parcel and an invoice need. There is no account to create and no password to choose, because the shop does not keep customer accounts.

What we do with it

We use it to fulfil your order and to talk to you about it: confirming what you bought, quoting shipping, sending an invoice, and telling you when it is posted. We do not send marketing email, because we do not run a mailing list.

Who else sees it

• Australia Post, or another carrier, gets the delivery address, because a parcel cannot arrive without one.
• Our email provider carries the messages we send you.
• Nobody else. We do not sell, rent, or trade personal information, and we do not use advertising or tracking networks.

Our website and database run on servers in Europe. Australian privacy law allows this, and the obligations in this policy follow the data wherever it is held.

How long we keep it

Orders and invoices are kept for five years. Business records have to be kept, and an invoice with the customer removed is not a record of anything.

Website statistics are kept for 180 days and then deleted automatically.

Website statistics

We count visits so we know whether anyone is finding the shop. What is recorded is the page, the date, the country, the kind of device, and the site that linked to us.

Your IP address is not stored. It is read, turned into a country name and a one-way code, and discarded. That code is rebuilt from scratch every day, so the same person can be counted once today and cannot be followed from one day to the next — not by us, and not by anyone who later reads the table.

We use no third-party analytics service, and no data about your visit leaves our own server.

Cookies

Three, all of them necessary, none of them advertising:

• bookstore_cart — remembers what is in your basket. Without it the basket empties on every page.
• bookstore_admin_session and bookstore_admin_challenge — only ever set for staff signing in to the administration. A customer never receives them.

There is no consent banner on this site because there is nothing to consent to.

Payment

We never see your card details, because the site never asks for them. Payment is arranged separately using the details on your invoice.

Keeping it safe

The site runs over an encrypted connection. Staff passwords are stored hashed, never in a readable form, and staff accounts can be protected with a second factor. Access to order data is limited to people who need it to run the shop.

Seeing or correcting what we hold

Write to orders@paperbark-books.com and ask. You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it.

We will reply within a reasonable time and will not charge you for asking.

Complaints

If you think we have mishandled your information, tell us first — write to orders@paperbark-books.com and we will look into it.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If this policy changes, the new version appears here. We will not quietly broaden what we collect and leave the old text up.